How to force HTTPS and redirect HTTP

An SSL certificate does not help if visitors can still reach the insecure HTTP version. Redirect all traffic to HTTPS.

Nginx

Add a server block listening on port 80 that redirects:

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;
}

nginx -t && systemctl reload nginx

Apache

<VirtualHost *:80>
    ServerName example.com
    Redirect permanent / https://example.com/
</VirtualHost>

Force HTTPS going forward (HSTS)

Add a header telling browsers to always use HTTPS for your domain:

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

If you do not have a certificate yet, see Free SSL certificate with Let's Encrypt.